Function reset_password 

pub async fn reset_password(
    state: State<AppState>,
    body: Json<Value>,
) -> HttpResponse

POST <base>/auth/password/reset — spend a reset token and set the password.

Every other outstanding reset for the account is spent at the same time: two links asked for in a moment of confusion should not leave the second one working after the first has been used.

The address is marked confirmed as a side effect, because it now has been — the link only reached somebody who reads it.